Binary code vulnerability detection method combining sparse attention and cross-modal interaction

Abstract

The application is suitable for the technical field of computer security and artificial intelligence, and particularly relates to a binary code vulnerability detection method combining sparse attention and cross-modal interaction, comprising: S1, performing static analysis on target binary code to obtain hexadecimal machine code; S2, performing feature extraction to generate assembly modal feature representation and hexadecimal modal feature representation; S3, mapping the assembly modal feature representation and the hexadecimal modal feature representation to a shared representation space; S4, generating intra-modal local features and cross-modal global features by using an attention mechanism combining sparse attention and cross-modal interaction; S5, weighting and fusing the intra-modal local features and the cross-modal global features to generate multi-modal fusion representation; and S6, predicting a target vulnerability category through a decision layer based on the multi-modal fusion representation. By introducing the sparse attention mechanism, the application effectively reduces the computational complexity of long sequence processing, significantly improves the reasoning efficiency, and embodies high efficiency.

Description

Technical Field

[0001] This invention belongs to the fields of computer security and artificial intelligence technology, and in particular relates to a binary code vulnerability detection method and system that combines sparse attention and cross-modal interaction. Background Technology

[0002] Existing binary code vulnerability detection methods have many shortcomings. Current methods typically rely on single-modal data analysis, such as detection based solely on assembly code or hexadecimal machine code. This single-modal analysis approach struggles to fully capture vulnerability characteristics and ignores the complementary information that may exist between different modalities, thus limiting the coverage and accuracy of vulnerability detection.

[0003] Furthermore, traditional vulnerability detection techniques face computational efficiency issues when processing long sequences of data (such as binary code). Models based on fully connected attention mechanisms have high computational complexity and consume significant resources when executed on large-scale binary datasets, making it difficult to meet the real-time requirements of practical applications.

[0004] Insufficient intermodal information exchange capability is also a significant shortcoming of existing methods. In scenarios attempting to combine multimodal data, current methods lack effective modal feature alignment and interaction mechanisms, easily losing important correlation information between different modalities, resulting in poor cross-modal feature fusion performance.

[0005] Furthermore, when faced with complex vulnerability scenarios, existing technologies struggle to capture the logical characteristics of vulnerabilities across instructions or byte sequences. This is especially true for vulnerability types that require deep semantic associations, where the adaptability and performance of existing methods are quite limited.

[0006] Based on the above shortcomings, there is an urgent need for a vulnerability detection method and system that can efficiently process long sequence data, fully mine multimodal data features and effectively fuse them, so as to improve the comprehensiveness and accuracy of detection, while reducing the consumption of computing resources. Summary of the Invention

[0007] The purpose of this invention is to provide a binary code vulnerability detection method that combines sparse attention and cross-modal interaction. It aims to solve the problem that existing technologies have difficulty capturing the vulnerability logic features across instructions or byte sequences when facing complex vulnerability scenarios. In particular, for vulnerability types that require deep semantic association, the adaptability and performance of existing methods are relatively limited.

[0008] This invention is implemented by combining sparse attention and cross-modal interaction in a binary code vulnerability detection method, the method comprising:

[0009] S1. Perform static analysis on the target binary code to obtain its assembly code and corresponding hexadecimal machine code;

[0010] S2. Extract features from assembly code and hexadecimal machine code using an independent modal encoder to generate assembly modal feature representations and hexadecimal modal feature representations;

[0011] S3. The extracted assembly modal feature representation and hexadecimal modal feature representation are mapped to a unified shared representation space through a projection layer;

[0012] S4. In the shared representation space, an attention mechanism combining sparse attention and cross-modal interaction is used to generate intra-modal local features and cross-modal global features.

[0013] S5. Weighted fusion of intra-modal local features and cross-modal global features to generate a multimodal fusion representation;

[0014] S6. Based on multimodal fusion representation, the target vulnerability category is predicted through the decision layer.

[0015] Preferably, step S2, extracting features from the assembly code and hexadecimal machine code using an independent modal encoder to generate assembly modal feature representations and hexadecimal modal feature representations, includes:

[0016] S201. Extract the modal features of the assembly code and encode the assembly modal feature representation using a language model;

[0017] S202. Extract hexadecimal machine code modal features, specifically including:

[0018] 1) Input Blocking: Divide the hexadecimal machine code into blocks according to bytes to construct the input vector sequence. :

[0019] ;

[0020] in, Indicates the length of the hexadecimal byte sequence. Indicates the first bytes, From 1 to index variables;

[0021] 2) Embedding layer mapping: Converts byte representations into embedding vectors through embedding layer mapping:

[0022] ;

[0023] in, Represents the embedding layer mapping. An embedding matrix representing the entire hexadecimal byte sequence;

[0024] 3) Contextual Feature Extraction: The network structure used to process byte sequences is used to extract the contextual features of the byte sequences.

[0025] ;

[0026] Feature matrix , This represents the hexadecimal modal feature, where d is the feature dimension. This represents a real-valued matrix with N rows and D columns.

[0027] Preferably, step S201, extracting assembly code modal features and encoding the assembly modal feature representation using a language model, includes:

[0028] 1) Input segmentation: Segment the assembly code according to instructions or operators to generate a token sequence:

[0029] ;

[0030] in, Indicates the first An assembly code marker, Indicates the sequence length of the assembly code. From 1 to index variables; A sequence of markers representing assembly code;

[0031] 2) Embedding layer mapping: The segmented token sequence is mapped to a high-dimensional vector space through the embedding layer:

[0032] ;

[0033] in, Indicates the embedding layer; Represents the feature vector mapped by the embedding layer;

[0034] 3) Contextual Feature Extraction: Contextual features are extracted from the embedded representation using a pre-trained language model.

[0035] ;

[0036] Feature matrix ,in, It is the feature dimension. This is a pre-trained Transformer model.

[0037] Preferably, step S3, mapping the extracted assembly modal feature representation and hexadecimal modal feature representation to a unified shared representation space through a projection layer, includes:

[0038] S301, Linear Transformation: Representation of extracted assembly modal features and hexadecimal modal features By applying a linear transformation, the transformed assembly mode feature matrix is ​​obtained. and sixteen-mechanism modal features :

[0039] ;

[0040] in, and Let be the projection matrix. and For bias terms;

[0041] S302, Shared Representation Space Alignment: Aligning features from two modalities and Mapping to the same dimension generates a shared representation:

[0042] ;

[0043] in, The length of the aligned feature sequence. To share the feature dimensions of the representation space;

[0044] S303, Output Feature Representation: The final generated modal features and It will be passed as input to the sparse attention mechanism.

[0045] Preferably, step S4, in the shared representation space, involves generating intra-modal local features and cross-modal global features using an attention mechanism that combines sparse attention and cross-modal interaction, including:

[0046] S401. Extract intra-modal features of sliding window attention. The sliding window attention mechanism is used to extract local contextual features within a single modality.

[0047] S402. Extract the inter-modal interaction features of global attention and capture global interaction information between different modalities through the global attention mechanism;

[0048] S403. Integrate sliding window attention and global attention to fuse intra-modal local features with inter-modal global interaction features, generating the final feature representation; intra-modal and inter-modal features are fused according to weight ratios.

[0049] ;

[0050] in, Hyperparameters control intramodal features Intermodal features The fusion ratio.

[0051] Preferably, step S401, extracting intra-modal features of the sliding window attention mechanism, whereby the sliding window attention mechanism is used to extract local contextual features within a single modality, includes:

[0052] 1) The modal feature matrices in the input shared representation space are respectively and ;

[0053] 2) Apply a fixed size to the feature sequence. Divide the window, and perform attention calculations only on the features within its local area;

[0054] 3) For each feature within a modality, calculate the attention weights within the sliding window;

[0055] in, Indicates the first Within the first feature window Attention weights for each feature and These are the weight matrices for the query and the key, respectively. This represents the size of the sliding window, which limits the calculation range and is usually much smaller than... ;

[0056] 4) Generate local features within the modality by weighted summation of features within the window:

[0057] ;

[0058] in, For value weight matrix, Represents a value vector;

[0059] 5) The output of the sliding window attention is represented as:

[0060] .

[0061] Preferably, step S402, extracting inter-modal interaction features for global attention and capturing global interaction information between different modalities through a global attention mechanism, includes:

[0062] 1) Select key instruction locations in the assembly code and key byte locations in the hexadecimal machine code as global attention nodes. The selection methods for key locations include selection by predefined rules and selection of high attention locations by automatic learning through the model.

[0063] 2) Calculate attention for global features of intermodal interactions:

[0064] ;

[0065] in, Indicates key locations in assembly code Key positions in hexadecimal machine code Attention weights;

[0066] Indicates the first The vector resulting from the transformation of each assembly feature by the query weight matrix;

[0067] Indicates the first A vector obtained by transforming a hexadecimal feature using a key weight matrix;

[0068] The feature dimensions of the shared representation space;

[0069] Softmax represents normalization;

[0070] The query weight matrix represents the assembly code;

[0071] Key weight matrix representing hexadecimal machine code;

[0072] and This represents the shared representation features after the linear transformation;

[0073] and These represent the key location sets for the two modes, respectively.

[0074] 3) Weighted summation of global interaction features between modalities:

[0075] ;

[0076] in, A weighted matrix representing the values ​​in hexadecimal machine code; Indicates the first A key assembly location integrates cross-modal global features of hexadecimal modality; Value vector representation of hexadecimal features;

[0077] 4) The output of global attention is represented as:

[0078] ;

[0079] in, Let represent the output matrix of the entire cross-modal global attention module, where each row corresponds to a fused feature at a key location.

[0080] Preferably, step S6, predicting the target vulnerability category through a decision layer based on multimodal fusion representation, includes:

[0081] S601, regarding the fusion feature matrix Global average pooling is applied to transform sequence features into vectors of fixed dimensions:

[0082] ;

[0083] in, This represents the feature matrix after multimodal fusion, which includes an integrated representation of assembly modal and hexadecimal modal features; Indicates global average pooling; Indicates the first The fused feature vector at each position; Indicates the length of the fused feature sequence;

[0084] S602. Use a fully connected layer to map the pooled features to the category dimension:

[0085] ;

[0086] in, This represents the weight matrix of the classification layer. This represents the bias vector of the classification layer. This represents an unnormalized category score vector;

[0087] S603, to Apply the Softmax activation function to generate the class probability distribution;

[0088] S604. Based on the Softmax probability distribution, select the category with the highest probability as the prediction result:

[0089] ;

[0090] in, This indicates the final predicted vulnerability category, and arg max returns the index of the category with the highest probability.

[0091] Preferably, the category probability distribution is represented as follows:

[0092] ;

[0093] in, Indicates that the sample belongs to the category The predicted probability; Representing vectors The element This indicates the total number of predefined vulnerability categories.

[0094] Preferably, the attention weights within the sliding window are represented as follows:

[0095] ;

[0096] in, Indicates the first Within the first feature window Attention weights for each feature Indicates the first Query vectors for each position, express A key vector at each position, and These are the weight matrices for the query and the key, respectively. This indicates the size of the sliding window.

[0097] The binary code vulnerability detection method provided by this invention, which combines sparse attention and cross-modal interaction, effectively reduces the computational complexity of long sequence processing and significantly improves inference efficiency by introducing a sparse attention mechanism, demonstrating high efficiency. Through inter-modal interaction and key location focusing mechanisms, it enhances the ability to identify vulnerability features and significantly improves detection accuracy. Furthermore, this invention supports multimodal input and modular expansion, possessing good scalability and applicable to various types of binary files and diverse detection tasks. In addition, this invention balances theoretical performance with practical engineering implementation needs, improving the model's expressive power while adapting to deployment requirements in computationally limited environments, demonstrating a strong advantage in combining theoretical and engineering applicability. Attached Figure Description

[0098] Figure 1 The flowchart illustrates a binary code vulnerability detection method combining sparse attention and cross-modal interaction, as provided in an embodiment of the present invention. Detailed Implementation

[0099] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0100] like Figure 1 The diagram shows a flowchart of a binary code vulnerability detection method combining sparse attention and cross-modal interaction provided by an embodiment of the present invention. The method includes:

[0101] S1. Perform static analysis on the target binary code to obtain its assembly code and corresponding hexadecimal machine code.

[0102] S2. Features are extracted from the assembly code and hexadecimal machine code using an independent modal encoder to generate assembly modal feature representations and hexadecimal modal feature representations, specifically including:

[0103] S201. Extracting Modal Features of Assembly Code: As a type of text modal data, assembly code can be encoded using a language model. This includes the following steps:

[0104] 1) Input segmentation: Segment the assembly code according to instructions or operators to generate a token sequence:

[0105] ;

[0106] in, Indicates the first An assembly code marker, Indicates the sequence length of the assembly code. From 1 to index variables; A sequence of markers representing assembly code;

[0107] 2) Embedding layer mapping: The segmented token sequence is mapped to a high-dimensional vector space through the embedding layer:

[0108] ;

[0109] in, Indicates the embedding layer; Represents the feature vector mapped by the embedding layer;

[0110] 3) Contextual Feature Extraction: Utilize pre-trained language models (such as Transformer, BERT) to extract contextual features from the embedded representations.

[0111] ;

[0112] Feature matrix ,in, It is the feature dimension. For a pre-trained Transformer or its variant model;

[0113] S202. Extract hexadecimal machine code modal features. Hexadecimal machine code, as byte sequence data, differs from text modality and requires a feature extraction process tailored to its characteristics. This includes the following steps:

[0114] 1) Input Blocking: The hexadecimal machine code is divided into blocks according to bytes.

[0115] ;

[0116] in, Indicates the length of the hexadecimal byte sequence. Indicates the first 1 byte;

[0117] 2) Embedding layer mapping: Converts byte representations into embedding vectors through embedding layer mapping:

[0118] ;

[0119] 3) Contextual Feature Extraction: Extract contextual features of byte sequences using a network structure suitable for processing byte sequences (such as Transformer or its variants).

[0120] ;

[0121] Feature matrix .

[0122] S3. The extracted modal features are mapped to a unified shared representation space through a projection layer, specifically including:

[0123] S301, Linear Transformation: Feature Representation of Two Modes and Applying linear transformations:

[0124] ;

[0125] in, and Let be the projection matrix. and For bias terms;

[0126] S302, Shared Representation Space Alignment: Mapping features from two modalities to the same dimension to generate a shared representation.

[0127] ;

[0128] in, The length of the aligned feature sequence. To share the feature dimensions of the representation space;

[0129] S303, Output Feature Representation: The final generated modal features and It is passed as input to the sparse attention mechanism to further extract intra-modal and inter-modal contextual information.

[0130] S4. In the shared representation space, an attention mechanism combining sparse attention and cross-modal interaction is used to generate intra-modal local features and cross-modal global features, specifically including:

[0131] S401. Extract intra-modal features of sliding window attention. The sliding window attention mechanism is used to extract local contextual features within a single modality (assembly code or hexadecimal machine code), specifically including:

[0132] 1) The modal feature matrices in the input shared representation space are respectively and ;

[0133] 2) Apply a fixed size to the feature sequence. Divide the window, and perform attention calculations only on the features within its local area;

[0134] 3) For each feature within a modality, calculate the attention weights within the sliding window;

[0135] ;

[0136] in, Indicates the first Within the first feature window Attention weights for each feature and These are the weight matrices for the query and the key, respectively. This represents the size of the sliding window, which limits the calculation range and is usually much smaller than... ;

[0137] 4) Generate local features within the modality by weighted summation of features within the window:

[0138] ;

[0139] in, For value weight matrix, Represents a value vector;

[0140] 5) The output of the sliding window attention is represented as:

[0141] .

[0142] S402. Extract inter-modal interaction features for global attention. This involves using a global attention mechanism to capture global interaction information between different modalities, such as the relationship between key instructions in assembly code and important bytes in hexadecimal machine code. Specifically, this includes:

[0143] 1) Select key instruction locations in the assembly code and key byte locations in the hexadecimal machine code as global attention nodes. Key locations can be selected in the following ways:

[0144] 1) Critical locations in assembly code: Certain instructions in the assembly code (such as function calls and conditional jumps) are more likely to be related to vulnerabilities and require special attention. The specific steps are as follows:

[0145] a) Input assembly code The instructions are labeled according to their type, which includes: function call (CALL), conditional jump (JUMP), memory operation (LOAD / STORE), etc.

[0146] b) Select a set of instruction locations closely related to the vulnerability detection task based on predefined rules:

[0147] ;

[0148] in, A predefined set of key instructions;

[0149] c) For each position Define importance score :

[0150] .

[0151] The key location set is as follows:

[0152] ;

[0153] 2) Critical positions in hexadecimal machine code: In machine code, certain bytes may represent pointers to critical operations or memory references, and are therefore of high importance. The specific steps are as follows:

[0154] a) Input hexadecimal machine code We analyze the function of each byte by dividing it into blocks.

[0155] b) Select byte locations that may represent key functions (such as pointers, jump addresses, etc.), for example: symbolic address locations, where the byte value range is in a special address segment.

[0156] c) Define importance score :

[0157] ;

[0158] in, For key byte positions, the set of key positions is:

[0159] ;

[0160] 3) Pre-trained model learns key locations: High-attention locations are automatically learned during training to supplement important regions that are difficult to capture by explicit rules. The specific steps are as follows:

[0161] a) Input the embedded representations of assembly code and hexadecimal machine code into separate feature extractors;

[0162] b) Calculate the attention weight for each location using a self-attention mechanism:

[0163] ;

[0164] in, and These represent the weight matrices for the lookup and key in the assembly code, respectively. and These represent the weight matrices for the lookup and key in the hexadecimal machine code, respectively.

[0165] c) Define the threshold for attention weights Locations with scores greater than a threshold are selected as key locations:

[0166] ;

[0167] 4) Perform a union operation on the key location sets selected by the rules and those selected by learning:

[0168] ;

[0169] in, and These represent the selection rules and learning rules for key locations in the assembly code, respectively. and These represent the selection rules and learning rules for key positions in the hexadecimal machine code, respectively.

[0170] 2) Calculate attention for global features of intermodal interactions:

[0171] ;

[0172] in, Indicates key locations in assembly code Key positions in hexadecimal machine code Attention weights The query weight matrix represents the assembly code. The key-weight matrix representing the hexadecimal machine code. and These represent the key location sets for the two modes, respectively.

[0173] 3) Weighted summation of global interaction features between modalities:

[0174] ;

[0175] in, A weighted matrix representing the values ​​of hexadecimal machine code.

[0176] 4) The output of global attention is represented as:

[0177] ;

[0178] S403. Integrate sliding window attention and global attention, fusing local features within a modality (sliding window attention) with global interaction features between modalities (global attention) to generate the final feature representation; intra-modal and inter-modal features are fused according to weight ratios:

[0179] ;

[0180] in, This is a hyperparameter that controls the fusion ratio of intra-modal features to inter-modal features.

[0181] S5. Weighted fusion of local features within a modality and global features across modalities generates a multimodal fusion representation.

[0182] S6. Based on multimodal fusion representation, the target vulnerability category is predicted through the decision layer, specifically including:

[0183] Multimodal features fused from input Mapping to a fixed category space, outputting the category label to which the vulnerability belongs. Assuming the number of vulnerability categories is C, the steps of the classification module are:

[0184] S601, regarding the fusion feature matrix Global Average Pooling (GAP) is applied to transform sequence features into vectors of fixed dimensions:

[0185] ;

[0186] in, This represents the feature matrix after multimodal fusion, which includes an integrated representation of assembly modal and hexadecimal modal features; Indicates global average pooling; Indicates the first The fused feature vector at each position; Indicates the length of the fused feature sequence;

[0187] S602. Use a fully connected layer to map the pooled features to the category dimension:

[0188] ;

[0189] in, This represents the weight matrix of the classification layer. This represents the bias vector of the classification layer;

[0190] S603, to Apply the Softmax activation function to generate the class probability distribution:

[0191] ;

[0192] S604. Based on the Softmax probability distribution, select the category with the highest probability as the prediction result:

[0193] ;

[0194] This invention also provides a code vulnerability detection system combining sparse attention and cross-modal interaction, comprising: an input module, a feature extraction module, a feature fusion module, and a decision module, wherein:

[0195] The input module is used to receive assembly code and its corresponding hexadecimal machine code;

[0196] The feature extraction module is used to encode and represent features of multimodal input data;

[0197] The feature fusion module is used to generate multimodal fusion representations through sparse attention mechanisms and cross-modal interactions;

[0198] The decision module is used to analyze the multimodal fusion representation and output vulnerability detection results.

[0199] The feature fusion module includes:

[0200] The sliding window attention submodule is used for extracting local features within a modality;

[0201] The global attention submodule is used to generate global interaction features between modalities;

[0202] The fusion submodule is used to weightedly combine local features within a modality with global features between modalities to form the final fused representation.

[0203] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A binary code vulnerability detection method combining sparse attention and cross-modal interaction, characterized in that, The method comprises: S1, static analysis of target binary code, obtaining its assembly code and corresponding hexadecimal machine code; S2, feature extraction of assembly code and hexadecimal machine code by independent modal encoder, generating assembly modal feature representation and hexadecimal modal feature representation; S3, mapping the extracted assembly modal feature representation and hexadecimal modal feature representation to a unified shared representation space through a projection layer; S4, in the shared representation space, an attention mechanism combining sparse attention and cross-modal interaction is used to generate intra-modal local features and cross-modal global features; S5, the intra-modal local features and the cross-modal global features are weighted and fused to generate a multi-modal fusion representation; S6, based on the multi-modal fusion representation, the target vulnerability category is predicted through the decision layer; S3, the step of mapping the extracted assembly modal feature representation and hexadecimal modal feature representation to a unified shared representation space, comprising: S301, linear transformation: on the extracted assembly modal feature representation and hexadecimal modal features apply linear transformation, get the converted assembly modal feature matrix and hexadecimal modal features : ； wherein and is a projection matrix, and is a bias term; S302, Shared Representation Space Alignment: Aligning features from two modalities and Mapping to the same dimension generates a shared representation: ； wherein, is the length of the aligned feature sequence, is the feature dimensionality that shares the representation space; S303、output the feature representation, the finally generated modal feature and will be passed as input to the sparse attention mechanism; S4, the step of generating intra-modal local features and cross-modal global features in the shared representation space by using an attention mechanism combining sparse attention and cross-modal interaction, comprising: S401, extracting intra-modal features of sliding window attention, and the sliding window attention mechanism is used to extract local context features within a single modal; S402, extracting inter-modal interaction features of global attention, and the global attention mechanism is used to capture global interaction information between different modes; S403, fuse the sliding window attention and the global attention, fuse the local features within the modal and the global interaction features between the modal to generate the final feature representation ; the intra-modal features and the inter-modal features are fused according to the weight proportion: ； wherein, is a hyper-parameter controlling the fusion ratio of intra-modal features and inter-modal features. and inter-modal features.

2. The method of claim 1, wherein the method is implemented by a computer system comprising one or more processors. S2, the step of feature extraction of assembly code and hexadecimal machine code by independent modal encoder, generating assembly modal feature representation and hexadecimal modal feature representation, comprising: S201, extracting assembly code modal features, and using a language model to encode the assembly modal feature representation; S202, extracting hexadecimal machine code modal features, specifically comprising: 1) Input chunking: Hexadecimal machine code is chunked by the byte to construct the input vector sequence : ； wherein, represents the length of the hexadecimal byte sequence, represents the first byte, is an index variable from 1 to . 2) embedding layer mapping: converting byte representation into embedding vector, through embedding layer mapping: ； wherein, represents an embedding layer mapping, represents an embedding matrix for the entire sequence of hexadecimal bytes 3) context feature extraction: using a network structure for processing byte sequence to extract context features of byte sequence: ； feature matrix , represents a hex mode feature, d is the feature dimension, represents a real-valued matrix of N rows and D columns.

3. The method of claim 1, wherein, S201, the step of extracting assembly code modal features and using a language model to encode the assembly modal feature representation, comprising: 1) Input word segmentation: The assembly code is segmented according to instructions or operators to generate a token sequence : ； wherein, represents the first assembly code tag, represents the sequence length of the assembly code, is an index variable from 1 to ; and represents the tag sequence of the assembly code. 2) embedding layer mapping: mapping the token sequence after tokenization to a high-dimensional vector space through an embedding layer: ； wherein, represents an embedding layer; represents an embedding layer mapping a feature vector; 3) context feature extraction: using a pre-trained language model to extract context features of embedding representation: ； feature matrix wherein, is a feature dimension, is a pre-trained Transformer model, is an extracted assembly modality feature.

4. The method of claim 1, wherein, S401, the step of extracting intra-modal features of sliding window attention, and the sliding window attention mechanism is used to extract local context features within a single modal, comprising: 1) input the modal feature matrix in the shared representation space respectively as and ; 2) Fixed size partitioning of feature sequences windows, each window only attends to features in its local range. 3) for each intra-modal feature, calculate the attention weight within the sliding window; wherein, denotes the attention weight of the th feature in the th feature window, and are the weight matrices of the query and key, respectively, denotes the size of the sliding window, limiting the computation range, which is usually much smaller than ; 4) weighted sum of window features to generate intra-modal local features: ； wherein, is a value weight matrix; denotes the shared representation feature after the linear transformation, denotes a value vector; 5) the output representation of sliding window attention is: 。 5. The method of claim 4, wherein, S402, the step of extracting inter-modal interaction features of global attention, and the global attention mechanism is used to capture global interaction information between different modes, comprising: 1) selecting key instruction positions in assembly code and key byte positions in hexadecimal machine code as global attention nodes, and the selection methods of key positions include pre-defined rule selection and automatic learning of high attention position selection by model; 2) Global feature computation attention for inter-modal interaction: ； where, representing key locations in assembly code with key locations in hexadecimal machine code attention weights; Indicates the first The vector resulting from the transformation of each assembly feature by the query weight matrix; represents the vector of the sixteenth hexadecimal feature after the key weight matrix transformation; represents a characteristic dimension of the shared representation space; Softmax denotes normalization; query weight matrix representing assembly code key weight matrix representing the hexadecimal machine code; and denotes the shared representation feature after the linear transformation; and respectively denote the set of critical locations for the two modalities; 3) Weighted sum of inter-modal global interaction features: ； wherein, represents a value weight matrix of the hexadecimal machine code; represents a cross-modal global feature of the sixteenth key assembly position fused hexadecimal modality; represents a value vector representation of the hexadecimal feature; 4) The output representation of global attention is: ； wherein, represents the output matrix of the entire cross-modal global attention module, where each row corresponds to the fusion feature of a key position.

6. The method of claim 1, wherein, S6, based on the multi-modal fusion representation, the step of predicting the target vulnerability category through the decision layer, including: S601、to the fusion feature matrix Apply global average pooling to convert the sequence features into a fixed-dimensional vector: ； wherein, represents the feature matrix after multimodal fusion, containing the integrated representation of the assembly modal and hexadecimal modal features; represents the global average pooling; represents the fusion feature vector of the th position; represents the length of the fusion feature sequence; S602, using a fully connected layer to map the pooled features to the category dimension: ； wherein, denotes a weight matrix of the classification layer, denotes a bias vector of the classification layer, denotes an unnormalized class score vector; S603、to application of a Softmax activation function, a class probability distribution is generated; S604, according to the Softmax probability distribution, the category corresponding to the maximum probability is selected as the prediction result: ； where, represents the final predicted vulnerability class, arg max returns the class index with the largest probability.

7. The method of claim 6, wherein the method is implemented by a computer system comprising one or more processors and memory storing processor-executable instructions that, as a result of being executed by the one or more processors, cause the computer system to perform operations comprising: The category probability distribution is represented as: ； in, Indicates that the sample belongs to the category The predicted probability; Representing vectors The One element, This indicates the total number of predefined vulnerability categories.

8. The method of claim 4, wherein the method is characterized by, The attention weight in the sliding window is represented as: ； wherein, denotes the attention weight of the th feature in the th feature window, denotes the query vector of the th position, denotes the key vector of the th position, and denotes the sliding window size.

Images